Add authorization check to query menu items controller


Permissions based on queries